The most dangerous password on the internet this week is one nobody ever set. A newly disclosed OpenSSH flaw, dubbed SSHole and tracked as CVE-2026-123158, lets an attacker log into affected Linux servers with any password between 257 and 1,024 characters long — no stolen credentials, no SSH key, no guessing. According to SecurityWeek, the fix landed in OpenSSH 10.6p2 on November 5, a day after the project learned of it.
The bug lives in a narrow but consequential corner of the Linux world: servers running OpenSSH on the musl C library with PAM disabled. That combination is the default in Alpine Linux — the lightweight distribution behind a huge share of Docker containers — plus OpenWrt, Buildroot, and Yocto. The flaw is a "misinterpretation of whether a string is intended to be a password hash" that turns accounts with no usable password into open doors. Root is the prize: Alpine secures it with a `*` in the password field, which is supposed to mean no password can ever work. With SSHole, any long one does.
The conditions are specific but not rare: OpenSSH without PAM, password authentication enabled, an account with a `*` password field, and at least one local account with a `$5$` or `$6$` hash. "An attacker who can reach your SSH port can log in without knowing any password," Alpine warns. "It takes one connection, works every time, and needs no retries." Every Alpine release checked, 3.16 through 3.24 and edge, is affected.
What makes this disclosure different is why it was rushed. OpenSSH developer Damien Miller said the release went out as fast as possible because the project has "recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours," and now considers long embargo periods a practice that "primarily benefits attackers." The same week OpenAI's security model found 948 Linux kernel privilege-escalation paths, the window between a bug existing and a machine finding it is collapsing — and the disclosure clock with it.
No in-the-wild exploitation has been confirmed yet, but researchers expect scanning within hours. Shodan lists around 22 million systems with SSH open on port 22, and each attempt costs one connection, so attackers can afford to try them all. The fix: patch and restart sshd, or disable password authentication as a stopgap. For anyone running Alpine in production — likely, if you run containers — this is a patch-now bug.
— via SecurityWeek